CVE-2026-126934: Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ziplineto a version that resolves this vulnerability.Fixed in 4.8.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Zipline versions from 4.3.2 before 4.8.0 are affected when core.trustProxy is enabled. Deployments without that setting enabled are not identified as affected by the provided information.
What does an attacker need to exploit it?
An unauthenticated attacker only needs network access to the Zipline service and the ability to send requests with spoofed X-Forwarded-For headers. They can use a different header value on each request to obtain new rate-limit buckets.
What security controls can be bypassed?
The bypass enables unlimited guessing against login passwords, TOTP codes, and file and URL passwords by evading throttling. The stated impact is limited confidentiality and integrity impact, with no availability impact.
What version resolves the issue?
The affected range ends before Zipline 4.8.0, so upgrading to 4.8.0 addresses the vulnerable versions described.